What this tells you
Whether this person’s incoming email volume for the day was unusual relative to their own normal — useful context for interpreting other signals, such as a rise in junk or external mail.
What this can’t tell you
Receiving a lot of email is not itself risky, nor the user’s fault. It does not indicate compromise, wrongdoing, or a security decision, and a single unusual day should not be read as a problem on its own.
How we describe it
Unusual incoming email activity — this user received significantly more (or fewer) emails than their normal pattern.